|

$40 Million+ US Govt Crypto Heist Leads To Contractor Exec’s Son: ZachXBT

On-chain investigator ZachXBT says a $40 million-plus theft from US authorities crypto seizure wallets might hint again to John Daghita, an alleged risk actor who goes by “Lick,” and a contractor relationship tied to Daghita’s household.

The $40 Million+ Govt Crypto Wallet Robbery

In a Jan. 25 publish, ZachXBT pointed to Command Services & Support (CMDSS), describing it as a agency with “an energetic IT authorities contract in Virginia,” and alleging it was “awarded a contract to help the USMS in managing/disposing of seized/forfeited crypto belongings.” ZachXBT added: “It nonetheless stays unclear at this level how John obtained entry from his dad.”

The allegation lands in opposition to a backdrop of earlier tracing work revealed Jan. 23, the place ZachXBT linked pockets exercise and recorded chats to the identical persona. “Meet the risk actor John (Lick), who was caught flexing $23M in a pockets deal with straight tied to $90M+ in suspected thefts from the US Government in 2024 and a number of different unidentified victims from Nov 2025 to Dec 2025,” ZachXBT wrote.

ZachXBT’s thread facilities on a dispute in a Telegram group chat between “John” and one other risk actor, Dritan Kapplani Jr., in what the neighborhood calls “band for band (b4b)”, an on-the-spot contest to show who controls extra funds. ZachXBT mentioned the interplay was “totally recorded,” and claims the footage consists of screen-shared pockets balances and contemporaneous transfers that assist set up management.

According to the thread, the recording exhibits John screen-sharing an Exodus pockets displaying a Tron deal with holding $2.3 million. In a second phase, ZachXBT mentioned “one other $6.7M price of ETH” moved into an Ethereum deal with whereas the argument continued.

ZachXBT framed the important thing evidentiary level as possession continuity throughout addresses: “The recording captures that John clearly controls each addresses. Additional addresses can seemingly be discovered within the recordings. I then started tracing backwards to confirm the supply of funds.”

That tracing, ZachXBT mentioned, connects the cluster to a March 2024 switch of $24.9 million from a US authorities deal with tied to the Bitfinex crypto hack seizure. He additionally claimed $18.5 million “at present sits” at a cited deal with.

Beyond that 2024 linkage, ZachXBT asserted the first deal with he tracked was tied to “$63M+ inflows from suspected victims and authorities seizure addresses in This fall 2025,” itemizing a number of transactions and chains, and individually flagged an extra 4.17K ETH ($12.4 million) stream from MEXC into the identical cluster.

The Jan. 25 publish makes an attempt to clarify a possible entry path: if CMDSS was concerned in US Marshals Service crypto asset administration, the query turns into whether or not contractor-side techniques, credentials, or processes offered a gap, deliberately or in any other case. ZachXBT harassed that the precise mechanism stays unknown.

Shortly after the publish, ZachXBT mentioned CMDSS’s X account, web site, and LinkedIn “had been all simply deactivated,” and claimed Daghita “started trolling once more on Telegram.”

On X, the claims drew sharp reactions from distinguished Bitcoin commentators. Nakamoto Inc. CEO David Bailey wrote: “The son of the CEO of the corporate employed by the US Marshalls to safeguard the nation’s Bitcoin, stole $40m from it and now seems to be working. Treasury should safe the non-public keys from the Justice Department ASAP earlier than extra is stolen.”

Prominent Bitcoin advocate and co-founder of the Satoshi Nakamoto Institute Pierre Rochard framed the scenario in national-security phrases, posting, “This is a nationwide safety disaster,” and urging Congress to move the BITCOIN Act.

At press time, Bitcoin traded at $87,847.

Similar Posts